Repeating a warning from github about the old URL - dillo.org is not controlled by the devs and could become a malware route, is that right?

Yes, thanks for the reminder. This is what they write about:

https://dillo.org/post-sitemap.xml

At some point I should investigate if we can fill a complaint to get it taken down at least. Here is more info: https://dillo-browser.org/dillo.org.html